none
Eventlog.Entries Count does not match EventlogEntry.Index RRS feed

  • Question

  • Hello,

    I am trying to figure out why is it when I receive a EventlogEntry through the EntryWritten event, the index does not match the Eventlog.Entries.Count. Can someone kindly confirm this behavior and provide a workaround? Thanks

    Option Explicit On
    
    Imports System
    Imports System.Diagnostics
    Imports System.Threading
    
    Class MySample
        Public Shared Sub Main()
    
            Dim myNewLog As New EventLog()
            myNewLog.Log = "Security"
    
            AddHandler myNewLog.EntryWritten, AddressOf MyOnEntryWritten
            myNewLog.EnableRaisingEvents = True
    
    
            Console.WriteLine("Press 'q' to quit.")
            ' Wait for the EntryWrittenEvent or a quit command.
            While Char.ToLower(Convert.ToChar(Console.Read())) <> "q"
                ' Wait.
            End While
        End Sub ' Main
    
        Public Shared Sub MyOnEntryWritten(ByVal source As Object, ByVal e As EntryWrittenEventArgs)
            Console.ForegroundColor = ConsoleColor.Red
            Console.WriteLine("Entries.Count={0}", source.Entries.Count)
            Console.ForegroundColor = ConsoleColor.Yellow
            Console.WriteLine("e.Entry.Index={0}", e.Entry.Index)
        End Sub ' MyOnEntryWritten
    End Class ' MySample
    
    


    Which outputs the following:

    e.Entry.Index=193186
    Entries.Count=92378
    e.Entry.Index=193187
    Entries.Count=92378
    e.Entry.Index=193188
    Entries.Count=92378
    e.Entry.Index=193189
    Entries.Count=92378
    e.Entry.Index=193190
    Entries.Count=92378
    e.Entry.Index=193191
    Entries.Count=92378
    e.Entry.Index=193192
    Entries.Count=92378
    e.Entry.Index=193193
    Entries.Count=92378
    e.Entry.Index=193194
    Entries.Count=92378
    e.Entry.Index=193195
    Entries.Count=92379
    e.Entry.Index=193196
    Entries.Count=92379
    e.Entry.Index=193197

    The size of the eventlog in question is 29megs set to autooverwrite



    Thursday, April 23, 2009 2:59 PM

Answers

  • From the MSDN library article about EventLogEntry.Index:

    Remarks:
    This number is not necessarily zero-based.

    With AutoOverwrite, it is necessarily not zero-based.


    Hans Passant.
    • Marked as answer by Pyrokin5 Thursday, April 23, 2009 10:50 PM
    Thursday, April 23, 2009 4:30 PM
    Moderator

All replies

  • From the MSDN library article about EventLogEntry.Index:

    Remarks:
    This number is not necessarily zero-based.

    With AutoOverwrite, it is necessarily not zero-based.


    Hans Passant.
    • Marked as answer by Pyrokin5 Thursday, April 23, 2009 10:50 PM
    Thursday, April 23, 2009 4:30 PM
    Moderator
  • Hans,


       Thank you for your reply. Would you be able to propose a workaround to keep track of the index with autoOverwrite enabled?
    Thursday, April 23, 2009 5:22 PM
  • I don't understand your question, why do you need to keep track at all?  The Index property is just an ID, much like a primary key of a database table.  They definitely gave it the wrong name, "Index" was not a good choice.
    Hans Passant.
    Friday, April 24, 2009 12:59 AM
    Moderator
  • I keep track of the Index so if the program turns off, or the computer reboots, I can attempt to process any eventlog entries that I have missed when the program starts back up. I use the index primarily for speed, rather than searching the eventlog.entries collection for the last entry I processed. I take it I have no choice but to give up trying to use the Index Property?
    Friday, April 24, 2009 1:59 AM
  • Nah, that should be okay.  There's no guarantee made anywhere that you'll see Index N+1 after last have read N, but it likely does work that way.  As long as you don't use the number to index anything.  Do make sure you deal with the case where N+1 might have already disappeared.

    Hans Passant.
    Friday, April 24, 2009 10:48 AM
    Moderator